Standards Explorer

Principle	Description
Data & Privacy	Ensures the confidentiality, integrity, and privacy of data handled by AI agents.
Security	Protects against vulnerabilities and unauthorized access, ensuring the agent operates securely.
Safety	Prevents unintended and harmful actions, with robust controls and fail-safes.
Reliability	Ensures agents behave predictably and consistently, with proper error handling and recovery.
Accountability	Provides clear audit trails, logging, and human oversight for all agent actions.
Society	Aligns agent behavior with broader societal norms, ethics, and regulatory requirements.

AIUC-1

AIUC-1 – AI Agent Standard

Commercial framework for enterprise AI agent adoption, addressing data and privacy, security, safety, reliability, accountability, and societal risk.

#ai

Attribute	How C3A addresses it
Data Sovereignty	SOV-3-02-C requires external encryption key management, or equivalent mechanisms, for IaaS and PaaS; SOV-3-02-AC extends this to SaaS.
Data Residency	SOV-3-01-C1 requires customers to be able to check storage and processing locations; C2–C5 define location-specific service options.
Auditability	SOV-3-04-C requires logs that customers can record, retain, and review to identify access to their data.
Autonomy	SOV-4-09-C requires continued service when non-EU network connections are disconnected, with annual tests; customer connections are excluded.

C3A

C3A — Criteria enabling Cloud Computing Autonomy

BSI's non-binding criteria for judging how much control a customer keeps over a cloud service: data location, key management, staff, non-EU dependencies.

#governance
#data

CRA

EU Cyber Resilience Act (CRA) — Regulation 2024/2847

EU regulation mandating cybersecurity requirements for products with digital elements across their lifecycle: secure-by-design, vulnerability handling, updates.

#security

Attribute	How DICOM addresses it
Interoperability	Core purpose: standardized IODs, network services, and transfer syntaxes let imaging modalities, PACS, and viewers from different vendors exchange and correctly render images.
Compatibility	Conformance statements and negotiated transfer syntaxes let systems with different capabilities interoperate by explicitly declaring and matching supported features.
Extensibility	Private tags/data elements and vendor‑specific SOP classes allow proprietary extensions while preserving a standard‑conformant core data set.
Maintainability	Modular IODs, versioned Parts of the standard, and backward‑compatible tag encoding reduce the effort needed to evolve devices and archives over time.
Portability / Flexibility	The self‑contained DICOM file format (header + pixel data) allows images to be moved between systems, institutions, or storage media while remaining interpretable.
Security / Confidentiality / Integrity	Part 15 (Security and System Management Profiles) defines TLS‑based network security, digital signatures, and de‑identification profiles for protecting patient imaging data.
Auditability / Traceability	Audit trail mechanisms (aligned with IHE ATNA) and consistent patient/study/series identifiers support tracking access to and movement of imaging data.
Data Quality	Mandatory and conditional data elements, defined value representations (VR), and structured reporting reduce ambiguity and improve consistency of imaging metadata and findings.
Scalability / Performance	Efficient compressed transfer syntaxes, DICOMweb’s RESTful bulk retrieval, and query/retrieve services support large imaging volumes typical of modern radiology departments.
Reliability / Availability	Defined association negotiation, status codes, and retry‑friendly network services support robust transfer, though archive uptime and redundancy remain implementer/PACS‑vendor responsibilities.

DICOM

DICOM — Digital Imaging and Communications in Medicine

International standard for storing, transmitting, and managing medical imaging data across modalities, PACS, and viewers for cross-vendor interoperability.

#sector

Attribute	Relevance in DO-178C
Safety	Core purpose: ensure software does not introduce unacceptable safety risk; assurance level (A–E) derived from system safety assessment governs rigor.
Reliability	Requirements-based development, verification, and robustness testing reduce software contribution to failures.
Integrity	Data/control integrity via requirements, design constraints, partitioning assumptions, and verification of interfaces and data coupling/control coupling.
Traceability	Mandatory bidirectional traceability across requirements, design, code, tests, results, and problem reports.
Testability	Strong emphasis on verification including requirements-based tests and structural coverage up to MC/DC for Level A.
Auditability	Defined lifecycle data, reviews, SQA records, and certification artifacts enable authority audits and findings resolution.
Maintainability	Change control, configuration management, clear standards, and impact analysis preserve assurance after modification.
Modularity	Architectural decomposition with clear interfaces supports independent verification and containment of changes.
Robustness	Robustness testing and analyses (including handling of abnormal inputs and conditions) are required to show software resilience.
Fault Isolation	Assumes and supports partitioning/freedom from interference at the system level (e.g., with ARINC 653/DO-297 contexts) to prevent unintended interactions.
Compliance	Conformance demonstrated via objectives, plans, standards, checklists, and certification data.
Reproducibility	Controlled processes and configuration baselines enable repeatable builds and consistent verification results.
Analysability	Required for systematic reviews, analyses, and structural coverage assessment to understand software behavior and verify objectives.
Correctness	Central to requirements-based development; verification demonstrates that software correctly implements its requirements.
Predictability	Deterministic behavior essential for safety-critical systems; timing analysis and worst-case execution time often required.
Cyber-security	While DO-178C is not a security standard, it coordinates with DO-326A/DO-356A for airworthiness security when threats could affect safety.

DO-178C

DO-178C - Software Considerations in Airborne Systems and Equipment Certification

The de facto standard for developing and certifying airborne software, defining objective-based assurance levels (DAL A-E) tied to system safety impact.

#safety
#sector

ICT Category	Coverage (Clause)	Key Requirements
Web Content	Clause 9	Incorporates WCAG 2.1 Level A and AA in full; applies to websites and web applications
Non-Web Documents	Clause 10	PDF, Word documents, ePub, and other electronic documents; applies WCAG2ICT guidance
Software	Clause 11	Desktop applications, mobile apps, operating systems; platform-independent requirements
Hardware	Clauses 5, 8	Physical controls, displays, tactile indicators, audio jacks; accessibility of devices themselves
Telecommunications	Clause 6	Voice, video, messaging services; real-time text (RTT), captions, relay services
Video Capabilities	Clause 7	Audio description, captions, sign language; media player accessibility
Support Services	Clause 12	Help desks, technical support, training; accessible communication channels

Quality Attribute	Relevance in EN 301 549
Accessibility	Core focus: ensuring ICT products and services are usable by people with disabilities across web, software, hardware, and telecommunications. Foundation of all EN 301 549 requirements.
Usability	Enhanced through requirements for predictable behavior, clear navigation, sufficient time, error prevention and recovery. Universal design principles benefit all users, not just those with disabilities.
Inclusivity	Ensures equal access regardless of disability, age, device, or context of use; extends WCAG principles to all ICT products and services, reaching users in diverse situations.
Interaction Capability	Supports multiple input methods (keyboard, mouse, touch, voice, switch access); flexible interaction patterns from hardware controls to software interfaces enable diverse user needs.
Operability	WCAG POUR principle incorporated from WCAG 2.1: All functionality operable via multiple input methods; hardware controls accessible without complex manipulation; no timing dependencies that exclude users.
Understandability	WCAG POUR principle: Clear, readable content; predictable behavior; input assistance across web, software, documents, and hardware. References WCAG 3.1-3.3 extended to all ICT.
Robustness	WCAG POUR principle: Compatibility with diverse user agents, assistive technologies, and ICT environments through valid markup, standard APIs, and platform accessibility services. WCAG 4.1 extended.
Compliance	Foundation for EU legal compliance: Web Accessibility Directive 2016/2102 (public sector), European Accessibility Act 2019/882 (private sector from June 2025). Harmonized standard with presumption of conformity.
Flexibility	Content and interfaces adapt to screen sizes, orientations, zoom levels (up to 200%), color schemes, text spacing without loss of information or functionality. Hardware provides flexible mounting and positioning.
User Error Protection	Input validation, error identification, correction suggestions, confirmation mechanisms for critical actions; reversible operations. WCAG 3.3 extended to all ICT contexts including hardware controls.
Interoperability	Standard protocols and APIs enable integration with assistive technologies (screen readers, magnifiers, alternative input devices, switch access) across platforms, operating systems, and devices.
Consistency	Predictable navigation, identification, and behavior across pages, applications, and ICT products; consistent user interface components. WCAG 3.2 principles applied universally.

EN 301 549

EN 301 549 - Accessibility requirements for ICT products and services

European standard defining accessibility requirements for ICT products and services across the EU: web, software, hardware, telecoms, and documents.

#accessibility
#usability

Attribute	Relevance in ETSI EN 304 223
Security	Core principle requiring comprehensive protection of AI systems throughout their lifecycle against AI-specific threats.
Confidentiality	Protection of training data, model weights, and system configurations against unauthorized access and extraction attacks.
Integrity	Safeguarding AI assets against data poisoning, model manipulation, and unauthorized modifications to ensure trustworthy outputs.
Availability	Ensuring AI systems remain operational and resilient against denial-of-service and resource exhaustion attacks.
Robustness	Resistance to adversarial inputs, prompt injection, and edge cases that could compromise AI system behavior.
Traceability	Documented audit trails for models, datasets, prompts, and system decisions enabling forensic review and accountability.
Accountability	Clear assignment of responsibilities across stakeholder roles (Developers, System Operators, Data Custodians) with verifiable controls.
Auditability	Comprehensive logging of system and user actions, enabling compliance verification and incident investigation.
Maintainability	Support for timely security updates, patches, and ongoing monitoring throughout the AI system lifecycle.
Recoverability	Disaster recovery procedures addressing AI-specific attack scenarios and system restoration capabilities.
Resilience	Ability to withstand and recover from security incidents while maintaining essential AI system functions.
Transparency	Clear communication to end-users about data use, access, storage, system limitations, and failure modes.

Principle	Description
P1: Security Training	Role-based AI security training for personnel involved in AI development and deployment.
P2: Security-by-Design	Integration of protective measures into functionality from inception, not as afterthoughts.
P3: Audit Trails	Documented audit trails for models, datasets, and prompts enabling accountability and forensic review.
P4: Threat Modeling	AI-specific threat modeling covering poisoning, inversion, and membership inference attacks with human oversight capabilities.

Principle	Description
P5: Asset Inventory	Catalogues of AI components including interdependencies between model artifacts and system dependencies.
P6: Versioning & Authentication	Cryptographic authentication and version control for models, datasets, and pipeline artifacts.
P7: Disaster Recovery	Recovery procedures explicitly addressing AI-specific attack scenarios beyond traditional system failures.
P8: Data & Input Protection	Sanitization, validation checks, and safeguards for confidential training data, model weights, and parameters.
P9: Supply Chain Security	Secure software supply chain practices including vulnerability disclosure and incident response plans.

Principle	Description
P10: End-User Communication	Transparent guidance on data use, access, storage, limitations, failure modes, and proactive security update notices.

Principle	Description
P11: Timely Updates	Prompt deployment of patches and security fixes with contingencies when updates cannot be applied immediately.
P12: Operational Monitoring	Logging of system and user actions, anomaly and drift detection, and internal-state monitoring for threat response.

Principle	Description
P13: Controlled Decommissioning	Controlled transfer and disposal of training data and models with secure deletion of data and configurations.

ETSI EN 304 223

ETSI EN 304 223 - AI Cybersecurity Baseline Requirements

European standard setting baseline cybersecurity requirements for AI models and systems across their lifecycle, complementing the EU AI Act.

#security
#ai

Attribute	How EU CSF addresses it
Data Sovereignty	SOV-2 examines exposure to foreign authority; SOV-3 examines customer control over cryptographic access.
Data Residency	SOV-3 assesses confinement of storage and processing to European jurisdictions.
Portability	SOV-4 assesses migration of workloads to alternative EU-controlled solutions.
Compliance	SOV-7 assesses adherence to EU rules and evidence from certifications.

EU CSF

EU CSF — Cloud Sovereignty Framework

European Commission procurement framework for cloud sovereignty: eight objectives, five SEAL assurance levels, and a weighted sovereignty score.

#governance
#data

Attribute	Relevance in GDPR
Privacy	Core principle requiring protection of personal data and individual privacy rights through technical and organizational measures.
Data Protection	Comprehensive framework for safeguarding personal data throughout its lifecycle, from collection to deletion.
Transparency	Mandatory clear communication about data processing purposes, legal basis, retention periods, and individual rights.
Accountability	Organizations must demonstrate compliance through documentation, impact assessments, and governance structures.
Consent Management	Technical mechanisms for obtaining, recording, and managing valid consent for data processing activities.
Data Integrity	Ensuring personal data accuracy, completeness, and protection against unauthorized alteration or destruction.
Security	Robust technical and organizational measures to protect personal data against breaches, loss, and unauthorized access.
Auditability	Systems must maintain comprehensive logs and records to demonstrate compliance and support data subject rights.
Interoperability	Data portability requirements necessitate standard formats and seamless data transfer capabilities.
Availability	Ensuring data subjects can exercise their rights (access, rectification, erasure) in a timely manner.

GDPR

GDPR - General Data Protection Regulation

EU regulation governing the processing of personal data: individual rights, accountability, and privacy by design for anyone handling EU residents' data.

#privacy
#security

Attribute	How HL7 addresses it
Interoperability	Core purpose: shared data models (resources, messages, documents), uniform encodings, and well‑defined interactions enable cross‑vendor, cross‑organization exchange.
Compatibility	Profiles, constraints, and capability statements let systems co‑exist and negotiate supported features while sharing environments.
Extensibility	FHIR’s extension mechanism and profiling allow safe, discoverable additions without breaking base conformance; CDA templates provide a similar pattern.
Maintainability	Versioning, backward‑compatible patterns (e.g., FHIR’s lenient reads), and modular resources/profiles reduce effort to evolve interfaces.
Portability / Flexibility	Resource‑based APIs and standardized terminologies ease migration between systems and regions; implementation guides tailor for locales without forking the base.
Security / Confidentiality / Integrity	Security considerations across HL7 (e.g., FHIR’s security pages) recommend authenticated, authorized access (often via SMART on FHIR/OAuth 2.0), data integrity safeguards, and least‑privilege access.
Auditability / Traceability	AuditEvent and Provenance resources support recording access, disclosures, and lineage of clinical data for compliance and investigation.
Data Quality	Strong typing, required elements, value set bindings, invariants, and terminology services improve accuracy, completeness, and consistency.
Scalability / Performance	FHIR search parameters, pagination, and asynchronous Bulk Data ($export) support efficient querying and large‑scale data extraction for analytics and population health use cases.
Reliability / Availability	Indirect: acknowledgement patterns (V2), idempotency guidance, error handling, and async/bulk operations support robust exchanges, but runtime SLOs remain implementer responsibilities.

HL7 / FHIR

HL7 — Health Level Seven International (V2, CDA, FHIR)

Family of healthcare interoperability standards (V2, CDA, FHIR) for exchanging, integrating, and retrieving health information across organizations.

#sector

Quality	Rationale
Safety	The core of the standard. It’s all about ensuring that systems operate safely and fail in a predictable and safe manner.
Reliability	Closely linked to safety. The standard requires high levels of reliability to ensure that safety functions are available when needed.
Maintainability	The standard’s emphasis on a structured lifecycle, traceability, and change control directly supports the ability to maintain the system over time.
Testability	A rigorous verification and validation process is a cornerstone of the standard. This includes requirements for reviews, static analysis, and testing, making the system easier to verify and test.
Fault Tolerance	The standard explicitly addresses fault tolerance through concepts like Hardware Fault Tolerance (HFT) and Safe Failure Fraction (SFF).

IEC 61508

IEC 61508 - Functional safety of E/E/PE safety-related systems

Foundational cross-industry standard for functional safety of E/E/PE systems, built on a risk-based lifecycle and Safety Integrity Levels (SIL 1 to 4).

#safety

Attribute	Relevance in IEC 62304
Safety	Central concern. Risk management must be integrated throughout the software lifecycle.
Reliability	Required via verification, validation, and robust maintenance processes.
Maintainability	Emphasis on change control, problem resolution, and proper documentation.
Traceability	End-to-end traceability between requirements, implementation, tests, and risk controls.
Usability	Not a core focus, but indirectly relevant for safety and effectiveness.
Security	Not directly addressed in depth (older version), but relevant under risk control.

IEC 62304

IEC 62304 - Medical device software

International standard defining software life cycle processes for medical device software, including standalone Software as a Medical Device (SaMD).

#safety
#sector

FR	Name	Description
FR 1	Identification and Authentication Control (IAC)	Control access to the IACS by identifying and authenticating all users (humans, processes, and devices).
FR 2	Use Control (UC)	Enforce the privileges of authenticated users to perform actions on the IACS.
FR 3	System Integrity (SI)	Ensure the integrity of the IACS to prevent unauthorized manipulation.
FR 4	Data Confidentiality (DC)	Ensure the confidentiality of data on communication channels and in storage to prevent unauthorized disclosure.
FR 5	Restricted Data Flow (RDF)	Segment the IACS into zones and conduits to limit the necessary data flow.
FR 6	Timely Response to Events (TRE)	Respond to security violations by notifying the proper authorities, reporting needed evidence of the violation, and taking timely corrective action.
FR 7	Resource Availability (RA)	Ensure the availability of the IACS against denial-of-service attacks.

IEC 62443

IEC 62443 - Security for Industrial Automation and Control Systems

Series of standards for cybersecurity of industrial automation and control systems, spanning product development, system integration, and operation.

#security
#sector

Privacy Engineering Pillar	Implementation Focus	Technical Implications
Privacy by Design	Proactive integration of privacy protections into system architecture and design patterns.	Privacy requirements drive architectural decisions, data flow design, and component interfaces from initial system conception.
Privacy by Default	Systems configured to provide maximum privacy protection without user intervention or configuration.	Default settings, data collection practices, and sharing policies prioritize privacy; opt-out rather than opt-in mechanisms.
Data Minimization	Collect, process, and retain only the minimum data necessary for legitimate business purposes.	Technical controls limit data collection scope, implement automated retention policies, and support granular data deletion.
Transparency and Control	Users have visibility into data practices and meaningful control over their personal information.	User interfaces for consent management, data access, correction, and deletion; clear privacy notices and preference centers.
Security and Protection	Technical and organizational measures safeguard personal data throughout its lifecycle.	Encryption, access controls, secure communication, incident response, and breach notification capabilities.
Accountability and Governance	Organizations demonstrate compliance through systematic privacy management and documentation.	Privacy impact assessments, audit trails, privacy metrics, compliance reporting, and governance frameworks.

Quality Attribute	Privacy Engineering Relevance
Privacy	Core focus on protecting individual privacy rights through systematic technical and organizational measures throughout system lifecycle.
Data Protection	Comprehensive framework for safeguarding personal data through technical controls, access restrictions, and lifecycle management.
Transparency	Clear communication of data practices, processing purposes, and privacy choices through user interfaces and documentation.
Accountability	Systematic demonstration of privacy compliance through documentation, auditing, and governance processes.
Data Minimization	Technical implementation of collection limitation, purpose limitation, and retention minimization principles.
Consent Management	Technical mechanisms for obtaining, recording, managing, and honoring user consent across system components.
Auditability	Comprehensive logging and monitoring of privacy-relevant activities for compliance demonstration and incident investigation.
Security	Technical safeguards protecting personal data confidentiality, integrity, and availability throughout processing lifecycle.
Access Control	Granular controls over who can access personal data, under what circumstances, and for what purposes.
Data Integrity	Ensuring accuracy, completeness, and consistency of personal data throughout collection, processing, and storage.
Interoperability	Standardized interfaces and formats supporting data portability and cross-system privacy compliance.
Configurability	System flexibility allowing privacy preference customization and compliance with varying regulatory requirements.

IEEE 2857

IEEE 2857 - Privacy Engineering Guidelines

IEEE guidelines for engineering privacy into software and systems across the development lifecycle, translating privacy-by-design into technical practice.

#privacy
#general

Process	Purpose
Value elicitation	Identify ethical values relevant to the system and its stakeholders
Value prioritization	Resolve conflicts between competing values through structured stakeholder dialogue
Ethical risk assessment	Identify and evaluate risks to values throughout the concept and design phases
Values traceability	Track ethical values through operational concepts, requirements, and design decisions

Quality Attribute	Relevance
Explainability	Systems must be designed so that decisions and behaviors can be understood and accounted for — a prerequisite for ethical accountability.
Fairness	Value elicitation and prioritization processes explicitly address fair treatment of all affected stakeholder groups.
Accountability	Values traceability creates an auditable chain from ethical requirements to design decisions and system behavior.
Transparency	Stakeholder communication processes require open disclosure of value trade-offs and design rationale.
Bias Mitigation	Ethical risk assessment requires identifying where system design could cause disproportionate harm to specific groups.
Traceability	The ethical values traceability process is the structural backbone of the standard.
Autonomy	Human autonomy and dignity are named values that must be elicited, assessed, and preserved in system design.

IEEE 7000

IEEE 7000-2021 — Ethical Concerns in System Design

IEEE process for embedding ethical values into system design via value-based engineering: value elicitation, ethical risk assessment, and traceability.

#governance
#ai

Attribute	How IHE addresses it
Interoperability	Core purpose: profiles remove optionality and ambiguity from base standards (HL7, FHIR, DICOM), specifying exact actors and transactions so independently built systems interoperate in practice, not just in theory.
Compatibility	Defined actor/transaction combinations let systems from different vendors participate in the same workflow (e.g., document sharing, patient matching) by implementing a common, testable subset of behavior.
Extensibility	Profiles are modular and composable; new profiles can be added for emerging domains (e.g., mobile, AI results) without altering the underlying base standards.
Maintainability	Well‑bounded, versioned profiles with clear actor/transaction scope make it easier to implement, test, and evolve individual interfaces rather than a monolithic integration.
Portability / Flexibility	Profiles built on widely adopted base standards (FHIR, DICOM) allow solutions to be transferred between institutions or regions with comparable IHE adoption.
Security / Confidentiality / Integrity	ATNA and related security/privacy profiles define audit logging, secure node authentication, and consistent handling of access events across participating systems.
Auditability / Traceability	ATNA’s audit trail requirements, combined with DICOM/FHIR audit resources, give a standardized, cross‑system record of who accessed or shared what data, and when.
Data Quality / Data Integrity	PIX/PDQ reduce duplicate or mismatched patient records; document‑sharing profiles (XDS.b/MHD) enforce consistent metadata — including document hash and size for integrity verification — for retrievability and correct clinical context.
Testability / Verifiability / Certifiability	Connectathon testing and published Integration Statements provide objective, third‑party‑verified evidence of conformance, going beyond a vendor’s own claims.
Reliability / Availability	Well‑defined transaction sequences and error‑handling expectations within profiles support predictable, robust cross‑system workflows, though runtime SLOs remain implementer responsibilities.

IHE

IHE — Integrating the Healthcare Enterprise

Healthcare initiative defining integration profiles that combine HL7 and DICOM to solve interoperability problems, verified through Connectathon testing.

#sector

Term	Description
Protection Profile (PP)	Defines a set of security requirements for a specific category of products (e.g., firewalls, operating systems).
Security Target (ST)	Prepared by the product vendor, it specifies the security functions and assurance requirements of a particular product, known as the Target of Evaluation (TOE).
Security Functional Requirements (SFRs)	Specific security functions that a product must provide, such as user authentication or data encryption. The Common Criteria provides a standardized catalog of these functions.
Security Assurance Requirements (SARs)	Measures taken during development and evaluation to ensure that security functions are implemented correctly.
Evaluation Assurance Level (EAL)	A rating from EAL1 (functionally tested) to EAL7 (formally verified design and tested) that measures the depth and rigor of the evaluation process. A higher EAL indicates a more thorough evaluation but does not necessarily mean the product is inherently more secure.

ISO 15408

ISO/IEC 15408 - Common Criteria for IT Security

The Common Criteria framework for evaluating IT product security via protection profiles, security targets, and Evaluation Assurance Levels EAL1 to EAL7.

#security

Attribute	Relevance in ISO 26262
Auditability	Confirmation measures (independent reviews, audits, assessments) and safety case evidence enable external evaluation.
Availability	Indirectly managed: safety-related functions must be available as required for safety or move to a defined safe state; availability trade-offs are analyzed during HARA and design.
Compliance	Conformance with normative requirements and documented tailoring to demonstrate adherence to the standard.
Configurability	Variants and parameterization are controlled via configuration/change management to maintain safety across product lines.
Dependability	Umbrella attribute (availability, reliability, maintainability, safety) supported by the safety lifecycle, analyses, and confirmation measures.
Fault Isolation	Freedom from interference and partitioning prevent cascading effects between elements of different criticality.
Fault Tolerance	Redundancy, diagnostics, and safety mechanisms ensure continued safe operation or controlled transition to a safe state.
Integrity	Integrity of safety-related data and control flows avoids erroneous actuation and supports freedom from interference.
Maintainability	Controlled change and configuration management preserve safety after modifications across the lifecycle.
Observability	Diagnostic coverage and monitoring detect faults and support safe reactions.
Portability / Reusability	Qualification and integration of existing SW/HW and pre-qualified components enable safe reuse across platforms.
Reliability	Random hardware faults and failure modes are analyzed (FMEA/FMEDA) to support hardware metrics and safety targets.
Robustness	Architectural and implementation measures handle faults and perturbations without loss of safety.
Safety	Core objective: reduce unreasonable risk from hazards due to malfunctions using a defined safety lifecycle and ASIL-based risk reduction.
Security	Coordinated with ISO/SAE 21434; security controls are considered where necessary to prevent threats from causing safety hazards.
Testability	Extensive verification and validation across all lifecycle phases, including coverage-based testing and regression.
Traceability	End-to-end traceability from safety goals through requirements, design, implementation, tests, and safety case.

ISO 26262

ISO 26262 - Road vehicles — Functional safety

Automotive functional-safety standard for electrical and electronic systems, defining a risk-based safety lifecycle and ASIL A to D risk classification.

#safety
#sector

Dimension	Definition	Verification method
Syntactic quality	The degree to which data conforms to its specified syntax (format, encoding, structure)	Automated verification against a declared syntax specification
Semantic quality	The degree to which data correctly encodes its intended meaning, using explicitly defined metadata or references to an open technical dictionary	Automated verification against a semantic reference
Pragmatic quality	The degree to which data is fit for the purpose of its intended users	Validation by user groups, surveys, or feedback mechanisms

Part	Title	Published
ISO 8000-1	Overview	2022
ISO 8000-2	Vocabulary	2020
ISO 8000-8	Information and data quality: Concepts and measuring	2015
ISO 8000-64	Data quality management: Process maturity assessment	2022

Part	Title	Published
ISO 8000-100	Master data: Overview	2016
ISO 8000-110	Master data: Exchange of characteristic data (syntax, semantic encoding, conformance)	2021
ISO 8000-114	Application of ISO/IEC 21778 and ISO 8000-115 to portable data	2024
ISO 8000-115	Quality identifier prefixes	2024 (2nd ed.)
ISO 8000-150	Data quality management: Roles and responsibilities	2022

Part	Title	Published
ISO 8000-210	Sensor data: Data quality characteristics	2024

Standard	Relationship
ISO/IEC 25012 (via ISO/IEC 25024)	ISO 25012 defines data quality characteristics; ISO 8000 provides the verification and exchange requirements to achieve them. The two are designed to be used together.
ISO/IEC 25024	Defines measurement methods for ISO 25012 characteristics; ISO 8000-8 provides the conceptual framework (syntactic/semantic/pragmatic) that underpins those measurements.
ISO 22745	Companion standard defining how data requirement statements are constructed for use in ISO 8000-compliant master data exchanges.

Quality Attribute	Relevance in ISO 8000
Data Quality	Central subject of the entire series; ISO 8000 provides the normative framework for defining, measuring, and exchanging quality data.
Accuracy	Addressed through semantic quality requirements (ISO 8000-8) and the master data exchange framework; the data must correctly encode real-world values against a defined reference.
Completeness	Required as part of syntactic and semantic conformance; incomplete data that omits mandatory attributes fails ISO 8000-8 verification.
Consistency	ISO 8000-110 requires that exchanged master data is internally consistent and conforms to a declared data specification across all messages.
Correctness	Syntactic and semantic quality checks (ISO 8000-8) provide a computable definition of correctness applicable to any data domain.
Traceability	Provenance requirements across the series mandate that data carries a verifiable history of its origin and transformations.
Data Integrity	Portable data requirements and quality identifier schemes ensure data cannot be silently altered without invalidating its quality claims.

ISO 8000

ISO 8000 — Data Quality

International standard series for data quality and master data: defining, measuring, verifying, and exchanging quality data across sectors and systems.

#data

Attribute	How it is addressed or framed in ISO/IEC 12792
Transparency	Provides a taxonomy for selecting transparency information elements for AI systems and their stakeholders.
Model Transparency	Supports model-level transparency by structuring information about model capabilities, limitations, lifecycle context, and stakeholder needs.
Explainability	Helps distinguish transparency information needs from explanations of specific model behavior or outputs.
Accountability	Supports governance and review by making relevant AI system information explicit for responsible stakeholders.

ISO/IEC 12792

ISO/IEC 12792 - AI transparency taxonomy

Taxonomy of information elements helping AI stakeholders identify and address the transparency needs of AI systems across model, data, and governance.

#ai

Attribute	Relevance in ISO/IEC 14756
Performance Efficiency	Core concern. Provides frameworks for evaluating overall system performance under various loads.
Time Behaviour	Central focus. Defines methods for measuring response times and processing durations.
Resource Utilization	Addresses how efficiently the system uses hardware resources during operation.
Throughput	Specifically measures the rate at which the system can process transactions or data.
Capacity	Covers the system’s ability to handle increasing workloads while maintaining acceptable performance.
Reliability	Indirectly addressed through consistent performance under specified conditions over time.
Latency	Focuses on measuring delays in system response to user actions.

ISO/IEC 14756

ISO/IEC 14756 - Measurement and Rating of Performance of Computer-Based Software Systems

Methods for measuring and rating user-oriented performance of computer-based software systems from the user's perspective: response times and throughput.

#general

Attribute	How it is addressed or framed in 22989
Reliability	Terms for performance consistency and dependable behavior across lifecycle phases
Safety	Concepts relating to harm, hazard, and safe operation of AI systems
Security	Terminology linking security properties (confidentiality, integrity, availability) to AI contexts
Robustness	Definitions around robustness to perturbations, uncertainty, and dataset shift
Resilience	Concepts for recovery and continued operation under adverse conditions
Transparency	Shared language for making AI system capabilities and limitations visible
Explainability	Definitions for explainability/interpretability to support understanding of outputs
Accountability	Roles and responsibilities, human oversight, assurance concepts
Fairness / Bias mitigation	Terms for bias, fairness, and mitigation approaches
Privacy	Concepts for data protection in AI lifecycles
Data quality	Dataset, labeling, quality characteristics across training/validation/testing
Usability / human factors	Human-in/on/over-the-loop, human oversight terminology
Maintainability	Lifecycle and change-related terms that support maintainable operation
Traceability	Terminology for artifacts, provenance, and evidence across the lifecycle

ISO/IEC 22989

ISO/IEC 22989 - AI concepts and terminology

Foundational vocabulary for artificial intelligence: core concepts and terms for AI systems, data, lifecycle stages, roles, and AI properties.

#ai

Characteristics	Description	Sub-Characteristics
Functional Suitability	The degree to which a product or system provides functions that meet stated and implied needs when used under specified conditions.	Functional Completeness Functional Appropriateness Functional Correctness
Performance Efficiency	The performance relative to the amount of resources used under stated conditions.	Time Behavior Capacity Resource Utilization
Compatibility	The degree to which a product, system or component can exchange information with other products, systems or components, and/or perform its required functions, while sharing the same hardware or software environment.	Co-Existence Interoperability
Interaction Capability	The degree to which a product or system can be operated by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use. (Formerly Usability)	Appropriateness Recognisability Learnability Operability User Error Protection User Engagement Inclusivity User Assistance Self Descriptiveness
Reliability	The degree to which a system, product or component performs specified functions under specified conditions for a specified period of time.	Faultlessness Fault Tolerance Availability Recoverability
Security	The degree to which a product or system protects information and data so that persons or other products or systems have the degree of data access appropriate to their types and levels of authorization.	Confidentiality Integrity Non-Repudiation Accountability Authenticity Resistance
Maintainability	The degree of effectiveness and efficiency with which a product or system can be modified by the intended maintainers.	Modularity Reusability Analysability Modifiability
Flexibility	The degree to which a product or system can be adapted for different or evolving hardware, software or other operational or usage environments. (Formerly Portability)	Testability Adaptability Scalability Installability Replaceability
Safety	The degree to which a product or system avoids harm to people, business, software, property or the environment in a specified context of use.	Operational Constraints Risk Identification Fail Safe Hazard Warning Safe Integration

ISO/IEC 25010

ISO/IEC 25010 - Systems and Software Quality

The SQuaRE product quality model defining nine characteristics, from functional suitability and performance to security, maintainability, and safety.

#general
#usability

Quality Attribute	Why it is relevant in ISO/IEC 25012
Data Quality	Core focus of the standard: defines a formal model for data quality characteristics.
Accuracy	Data should correctly represent real-world values and facts.
Completeness	Required information should be present for intended use.
Consistency	Data should not contradict itself across records/sources/rules.
Currentness	Data should be sufficiently up to date for the intended decision/process.
Credibility	Data should be trustworthy for stakeholders and use cases.
Availability	Data should be available when needed by authorized users/processes.
Confidentiality	Data access/disclosure must be controlled and protected.
Compliance	Data handling should conform to regulatory and organizational constraints.
Traceability	Data lineage/provenance should be understandable and auditable.

ISO/IEC 25012

ISO/IEC 25012 - Data Quality Model

SQuaRE-family data quality model defining 15 data quality characteristics across inherent and system-dependent perspectives for information systems.

#data

Characteristic	Description
Beneficialness	extent of benefit resulting from the use of a product, system or service
Freedom from Risk	extent to which a product or system mitigates the potential risk to economic status, human life, health, society, financial values, enterprise activities, or the environment
Acceptability	extent to which a human response is favourable when accepting or installing a product, system or service software tool designed to perform some frequently used function

ISO/IEC 25019

ISO/IEC 25019 - Quality-in-use model

The SQuaRE quality-in-use model describing the outcome of system use through three characteristics: beneficialness, freedom from risk, and acceptability.

#general

Attribute	Relevance in ISO/IEC 25022
Effectiveness	The accuracy and completeness with which users achieve specified goals.
Efficiency	The resources expended in relation to the accuracy and completeness with which users achieve goals.
Satisfaction	The degree to which user needs are satisfied when a product or system is used in a specified context of use.
Freedom from risk	The degree to which a product or system mitigates the potential for economic risk, health and safety risk, and environmental risk.
Context Coverage	The degree to which a product or system can be used with effectiveness, efficiency, freedom from risk and satisfaction in all the specified contexts of use.

ISO/IEC 25022

ISO/IEC 25022 - Measurement of quality in use

SQuaRE measures for quality in use: effectiveness, efficiency, satisfaction, freedom from risk, and context coverage in a specified context of use.

#data
#usability

Characteristic	Description
Accuracy	The degree to which data correctly represents the real-world entities or values they are intended to model.
Completeness	The degree to which all required data is present and no essential information is missing.
Consistency	The degree to which data is uniform and coherent across different datasets, systems, or time periods.
Credibility	The degree to which data is regarded as true and believable by users in a specific context of use.
Timeliness	The degree to which data is up-to-date and available when needed for decision-making or processing.
Precision	The degree to which data values are exact and have appropriate granularity for their intended use.
Traceability	The degree to which the origin, processing history, and lineage of data can be tracked and verified.
Availability	The degree to which data is accessible and retrievable when required by authorized users or systems.
Accessibility	The degree to which data can be accessed by authorized users through appropriate interfaces and mechanisms.
Integrity	The degree to which data is protected from unauthorized modification and maintains its accuracy over time.
Confidentiality	The degree to which data is protected from unauthorized access and disclosure.
Compliance	The degree to which data conforms to applicable regulations, standards, and organizational policies.

ISO/IEC 25024

ISO/IEC 25024 - Measurement of Data Quality

SQuaRE measures for evaluating data quality characteristics such as accuracy, completeness, consistency, and timeliness across the data lifecycle.

#data

Characteristic as of ISO/IEC 25010	Description	Sub-Characteristics
Functional Suitability	The degree to which a product or system provides functions that meet stated and implied needs when used under specified conditions.	Functional Adaptability Functional Correctness (modified)
Performance Efficiency	The performance relative to the amount of resources used under stated conditions.	Environmental Sustainability
Compatibility	The degree to which a product, system or component can exchange information with other products, systems or components, and/or perform its required functions, while sharing the same hardware or software environment.
Interaction Capability	The degree to which a product or system can be operated by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use. (Formerly Usability)	User Controllability Transparency
Reliability	The degree to which a system, product or component performs specified functions under specified conditions for a specified period of time.	Robustness
Security	The degree to which a product or system protects information and data so that persons or other products or systems have the degree of data access appropriate to their types and levels of authorization.	Intervenability
Maintainability	The degree of effectiveness and efficiency with which a product or system can be modified by the intended maintainers.
Flexibility	The degree to which a product or system can be adapted for different or evolving hardware, software or other operational or usage environments. (Formerly Portability)
Safety	The degree to which a product or system avoids harm to people, business, software, property or the environment in a specified context of use.

ISO/IEC 25059

ISO/IEC 25059 - Systems and Software Quality — Quality models for AI systems

Extended SQuaRE product quality model for AI systems defining seven modified or added sub-characteristics to the following characteristics of ISO 25010: functional sui...

#general
#ai

Attribute	Relevance in ISO/IEC 27001
Security	Holistic protection of information assets via risk management. Encompasses policies, controls, and continuous monitoring within the ISMS.
Confidentiality	Ensuring that information is accessible only to authorized individuals or systems.
Integrity	Maintaining the accuracy and completeness of information and preventing unauthorized modification.
Availability	Ensuring that authorized users have timely and reliable access to information when needed.
Authenticity	Authenticity is defined in the ISO vocabulary as the property that an entity is what it claims to be. This means mechanisms are in place to verify that users, systems, or data are genuine (e.g. digital signatures to confirm a message’s origin). By ensuring authenticity, ISO 27001 helps prevent impersonation and unauthorized entity access.
Non-repudiation	The ability to prove the occurrence of a claimed event or action and its originating entities. In practice, it means a party cannot deny (repudiate) the authenticity of their signature on a document or a sent message.
Compliance	A key driver for implementing the standard is to ensure legal, statutory, regulatory, and contractual requirements are met.
Reliability	Addressed through requirements for business continuity, system and network security, and operational procedures.

ISO/IEC 27001

ISO/IEC 27001 - Information security management

International standard specifying requirements for an information security management system (ISMS): risk-based establishment, operation, and improvement.

#security

Component	Description
Privacy Principles	Fundamental privacy principles including consent, purpose limitation, collection limitation, data minimization, use limitation, data quality, openness, individual participation, and accountability.
Privacy Actors	Identification of roles and responsibilities including data subject, PII controller, PII processor, and third parties in privacy-sensitive systems.
Privacy Safeguards	Technical and organizational measures to protect PII throughout its lifecycle, including collection, processing, storage, and disposal.
Privacy Controls	Systematic controls for privacy risk management, including preventive, detective, and corrective measures.
Privacy Risk Assessment	Framework for identifying, analyzing, and evaluating privacy risks associated with PII processing activities.
Privacy Requirements	Systematic approach to eliciting, analyzing, and specifying privacy requirements for information systems.

Quality Attribute	Relevance in ISO/IEC 29100
Privacy	Core focus on protecting personal information and individual privacy rights through systematic framework and principles.
Data Protection	Comprehensive approach to safeguarding personally identifiable information throughout its entire lifecycle.
Transparency	Openness principle requiring clear communication about PII processing practices, purposes, and individual rights.
Accountability	Organizations must demonstrate compliance with privacy principles and be accountable for PII protection measures.
Data Minimization	Collection limitation and data minimization principles requiring only necessary PII to be processed.
Consent Management	Framework for obtaining, managing, and respecting individual consent for PII processing activities.
Data Quality	Ensuring PII accuracy, completeness, relevance, and currency throughout processing lifecycle.
Security	Technical and organizational security measures to protect PII against unauthorized access, processing, and disclosure.
Auditability	Systematic documentation and monitoring capabilities to demonstrate privacy compliance and accountability.
Interoperability	Privacy framework compatibility across different systems, technologies, and jurisdictions for consistent PII protection.

ISO/IEC 29100

ISO/IEC 29100 - Privacy Framework

Privacy framework establishing common terminology, actors, and safeguards for processing personally identifiable information across its lifecycle.

#privacy
#general

Task	Purpose
Evaluate	Assess the current and future use of IT, considering stakeholder needs, organizational objectives, and external factors (technology trends, regulatory changes, risks).
Direct	Set direction through policies and plans that ensure IT supports organizational goals. Assign responsibilities and authorize resources.
Monitor	Measure IT performance against plans and objectives. Ensure conformance with policies, regulations, and ethical standards.

Principle	Governance Concern
Responsibility	Roles, accountability, and decision-making authority for IT are clearly defined and assigned throughout the organization.
Strategy	IT plans and investments are aligned with the organization’s current and future strategic objectives.
Acquisition	IT acquisitions are made for valid reasons, based on appropriate and ongoing analysis, with clear and transparent decision-making.
Performance	IT supports the organization by delivering services and meeting quality levels required by current and future business needs.
Conformance	IT complies with all mandatory legislation and regulations as well as internal policies and commitments.
Human Behaviour	IT governance respects human factors including the needs, expectations, and ethical considerations of all people affected by IT decisions.

Clause	Content
1 — Scope	Applicability to all organizations and IT governance contexts
2 — Normative References	References to ISO 37000 (Governance of organizations)
3 — Terms and Definitions	Consistent terminology for governance, IT, and stakeholders
4 — Good Governance of IT	Desired outcomes: performance, stewardship, ethics
5 — Principles	The six governance principles (see above)
6 — Model	The Evaluate–Direct–Monitor framework
7 — Framework	Implementation approach for applying principles in practice

Quality Attribute	Relevance in ISO/IEC 38500
Governability	Core focus: establishing policies, roles, and oversight structures for IT decision-making. The Evaluate–Direct–Monitor model is a governance framework in itself.
Compliance	Conformance principle: IT must comply with legislation, regulations, internal policies, and contractual commitments.
Accountability	Responsibility principle: clear assignment of roles, decision authority, and accountability for IT outcomes.
Auditability	Monitor task: governance requires measurable, auditable evidence of IT performance and conformance.
Transparency	Acquisition and Strategy principles: decisions must be made transparently and based on appropriate analysis.
Security	2024 edition strengthens cybersecurity governance; Conformance principle requires adherence to security policies and regulations.
Sustainability	2024 edition explicitly addresses environmental impact of IT operations and promotes eco-friendly technology choices.
Risk Identification	Evaluate task: governing bodies must assess risks to the organization arising from IT use.
Traceability	Monitor task: tracking IT decisions, investments, and outcomes back to organizational objectives and policies.
Performance	Performance principle: IT must deliver services that meet quality levels required by business needs.

ISO/IEC 38500

ISO/IEC 38500 - Governance of IT for the Organization

International standard giving governing bodies principles for the effective, efficient, and acceptable use of IT via an Evaluate-Direct-Monitor model.

#governance

Characteristic	Description
Transparency and Explainability	The degree to which it is possible to understand the AI system’s decisions and operational processes.
Fairness and Bias Mitigation	The degree to which an AI system avoids unfair or discriminatory impacts across different demographic groups.
Accountability	The degree to which an organization is answerable for its AI systems and their impacts.
Data Quality	The degree to which data used for training, validating, and operating AI systems is accurate, complete, and relevant.
Security	The degree to which an AI system is protected from threats to its availability, integrity, and confidentiality.
Ethical and Societal Considerations	The degree to which an AI system aligns with ethical principles and avoids negative societal consequences.

ISO/IEC 42001

ISO/IEC 42001 - Artificial Intelligence Management System

International standard framing an AI management system (AIMS) to develop and use AI responsibly, with transparency, fairness, and accountability.

#ai

Attribute	Relevance in ISO/IEC 5055
Reliability	Counts weaknesses that could cause faults at runtime or lead to system failure, thereby degrading dependable behavior.
Security	Counts weaknesses that introduce vulnerabilities exploitable by attackers, reducing protection of confidentiality, integrity, and availability.
Performance Efficiency	Counts weaknesses that produce excessive resource consumption or latency under stated conditions.
Maintainability	Counts weaknesses that make the code harder, riskier, or costlier to modify, test, or understand, thus impeding efficient evolution.

ISO/IEC 5055

ISO/IEC 5055 - Automated Source Code Quality Measures

International standard defining four automated source-code quality measures for reliability, security, performance efficiency, and maintainability.

#general
#coding

Topic Area	Coverage	Key Considerations
Trustworthiness Foundations	Definitions, concepts, and working frameworks for AI trustworthiness	Establishes what trustworthiness means in AI contexts; stakeholder expectations
Existing Frameworks	Survey of approaches from other technical domains applicable to AI	Traditional system assurance methods; their applicability and limitations for AI
Stakeholder Perspectives	Identification of AI system stakeholders and their concerns	Users, developers, operators, regulators, affected persons; their distinct expectations
High-Level Concerns	Responsibility, accountability, governance, and safety considerations	Governance frameworks; accountability chains; ethical and legal obligations
Vulnerabilities & Threats	AI-specific security risks and failure modes	Adversarial attacks, data poisoning, model extraction, bias amplification
Mitigation Measures	Techniques and methods to improve AI system trustworthiness	Testing strategies, monitoring approaches, control mechanisms across the AI lifecycle

ISO/IEC TR 24028

ISO/IEC TR 24028 - Overview of trustworthiness in artificial intelligence

Technical Report surveying trustworthiness in AI systems, cataloguing properties like reliability, robustness, safety, and fairness, plus AI threats.

#ai
#trustworthiness
#security

ISO/IEC/IEEE 12207

ISO/IEC/IEEE 12207 - Software Life Cycle Processes

ISO/IEC/IEEE framework defining software life cycle processes across acquisition, development, operation, maintenance, and disposal of software systems.

#general
#documentation

ISO/IEC/IEEE 26514

ISO/IEC/IEEE 26514 - Design and Development of Information for Users

Requirements for designing and developing user information across the software lifecycle: planning, information architecture, writing, and presentation.

#documentation
#usability
#accessibility

ISO/IEC/IEEE 29119

ISO/IEC/IEEE 29119 - Software Testing

International software testing standard series defining test processes, documentation, and techniques from small projects to regulated environments.

#general
#documentation

ISO/IEC/IEEE 42010

ISO/IEC/IEEE 42010 - Architecture Description

Framework for creating, evaluating, and comparing architecture descriptions using stakeholders, concerns, viewpoints, views, and documented decisions.

#documentation
#general

ISO/IEC/IEEE 42030

ISO/IEC/IEEE 42030 - Architecture Evaluation

Framework for systematically evaluating software, systems, and enterprise architectures: evaluation processes, methods, criteria, and quality models.

#documentation
#general

MISRA-C

MISRA C - Guidelines for the use of the C language in critical systems

Guidelines defining a safer subset of the C language for safety- and security-critical embedded systems, reducing undefined behavior for higher assurance.

#safety
#sector
#coding

NIST AI RMF

NIST AI RMF — Artificial Intelligence Risk Management Framework

NIST voluntary framework for managing AI risks across the system lifecycle, organized around seven trustworthiness characteristics and four functions.

#ai
#security
#trustworthiness

NIST PF

NIST Privacy Framework — Managing Privacy Risk

NIST voluntary tool for managing privacy risk in personal data processing through enterprise risk management, organized around five core functions.

#privacy
#security

NIST SP 800-53

NIST SP 800-53 — Security and Privacy Controls

US catalog of security and privacy controls for information systems, providing a risk-based baseline for compliance and continuous monitoring.

#security
#privacy

OWASP ASVS

OWASP Application Security Verification Standard (ASVS)

Open OWASP framework of requirement-level security controls for designing, building, and testing web applications and APIs, with three assurance levels.

#security

PCI DSS

PCI Data Security Standard (PCI DSS)

Payment card industry standard defining twelve baseline security requirements to protect cardholder data wherever it is stored, processed, or transmitted.

#security
#sector

SOC 2

SOC 2 — Service Organization Control 2

AICPA auditing framework producing a CPA attestation report on a service organization's controls across five Trust Services Criteria.

#security

SOX

SOX - Sarbanes-Oxley Act

US federal law mandating financial reporting accuracy and internal controls (ICFR) for systems that process, store, or report financial data.

#sector

WCAG 2.2

WCAG 2.2 - Web Content Accessibility Guidelines

The W3C standard for web accessibility: how to make web content usable by people with disabilities, organized around the four POUR principles.

#accessibility
#usability

Process Category	Description
Agreement Processes	Processes for establishing agreements between organizations, including acquisition, supply, and customer-supplier agreements.
Organizational Project-Enabling Processes	Processes that provide resources and infrastructure for project execution, including life cycle model management, infrastructure management, and human resource management.
Technical Management Processes	Processes for managing technical aspects of projects, including project planning, assessment, control, decision management, risk management, and configuration management.
Technical Processes	Core technical processes for system/software development including stakeholder requirements definition, requirements analysis, architectural design, implementation, integration, verification, validation, operation, maintenance, and disposal.

Quality Attribute	Relevance in ISO/IEC/IEEE 12207
Process Quality	Systematic framework for defining, implementing, and improving software lifecycle processes to ensure consistent quality outcomes.
Traceability	Requirements for maintaining traceability between lifecycle artifacts, decisions, and deliverables throughout the software lifecycle.
Maintainability	Explicit processes for software maintenance, including corrective, adaptive, perfective, and preventive maintenance activities.
Reliability	Verification and validation processes ensure software meets reliability requirements through systematic testing and quality assurance.
Configuration Management	Comprehensive configuration management processes for controlling changes and maintaining software integrity.
Risk Management	Systematic risk management processes for identifying, analyzing, evaluating, and treating software project risks.
Quality Assurance	Quality assurance processes embedded throughout the lifecycle to ensure adherence to standards and achievement of quality objectives.
Documentation	Systematic documentation processes ensuring comprehensive recording of decisions, designs, and deliverables.
Verification	Systematic verification processes to confirm that software products meet their specified requirements.
Validation	Validation processes to ensure software meets stakeholder needs and intended use in operational environment.

Quality Attribute	Relevance in ISO/IEC TR 24028
Reliability	Core trustworthiness property: AI systems must behave consistently under expected conditions; requires rigorous testing, validation, and ongoing monitoring throughout deployment.
Robustness	Critical for handling variability and adversarial inputs; validated through stress testing, boundary analysis, and adversarial probing; safe fallback modes when operating outside trained envelope.
Safety	High-level concern addressing avoidance of harm to people, property, or environment; requires hazard analysis, safety testing, and human oversight mechanisms, particularly for safety-critical applications.
Security	Protection against AI-specific threats including adversarial examples, model extraction, data poisoning, and privacy attacks; requires security-by-design and continuous vulnerability assessment.
Privacy	Data protection and minimization principles; defense against membership inference and model inversion attacks; compliance with privacy regulations like GDPR.
Accountability	Clear responsibility chains and governance structures; auditability of decisions; evidence trails for regulatory compliance and stakeholder trust.
Transparency	Stakeholder understanding of system capabilities, limitations, and decision processes; documentation of data sources, model architectures, and performance characteristics.
Explainability	Ability to provide comprehensible explanations for AI outputs; critical for high-stakes decisions in healthcare, finance, and legal contexts; supports debugging and accountability.
Fairness	Avoidance of discriminatory bias; equitable treatment across demographic groups; fairness audits and bias mitigation techniques throughout the AI lifecycle.
Accuracy	Correctness of AI outputs relative to ground truth; performance metrics appropriate to application context; ongoing validation as deployment conditions evolve.
Availability	Operational readiness and accessibility when needed; resilience to failures and attacks; service-level guarantees for mission-critical applications.
Testability	Ability to validate AI system behavior through systematic testing; challenge of achieving comprehensive coverage given vast input spaces and emergent behaviors.
Maintainability	Ongoing model updates, retraining, and monitoring to maintain trustworthiness as conditions change; version control and change management for data and models.
Compliance	Adherence to AI-specific regulations including EU AI Act, sector-specific requirements (medical devices, automotive), and ethical guidelines; documentation and audit readiness.

Attribute	Relevance in ISO/IEC/IEEE 26514:2022
Usability	A central focus, ensuring users can easily find, understand, and use the information to achieve their goals.
Clarity	Information should be clear, concise, and easy to understand.
Accessibility	Information should be accessible to all users, including those with disabilities.
Correctness	The information provided must be accurate and up-to-date.
Consistency	Information should be consistent in terminology, style, and format.
Comprehensibility	Information should be easy to understand for the target audience. In our terminology this is understandability
Conciseness	Information should be presented in a brief and to-the-point manner.
Minimalism	Providing only the necessary information to avoid overwhelming the user.

Part	Focus	Status
ISO/IEC/IEEE 29119-1	Concepts and definitions for software testing terminology	International Standard, 2022 edition
ISO/IEC/IEEE 29119-2	Test processes (organizational and project/test management processes)	International Standard, 2021 edition
ISO/IEC/IEEE 29119-3	Test documentation (test work products and reporting artifacts)	International Standard, 2021 edition
ISO/IEC/IEEE 29119-4	Test techniques	International Standard, 2021 edition
ISO/IEC/IEEE 29119-5	Keyword-driven testing	International Standard, 2024 edition
ISO/IEC TR 29119-6	Using the standard in agile development contexts	Technical Report, 2021 edition
ISO/IEC TR 29119-11	Guidance for testing AI-based systems	Technical Report, 2020 edition

Quality Attribute	Relevance in ISO/IEC/IEEE 29119
Testability	Core focus: structures test conditions, test cases, procedures, and execution so systems can be systematically tested.
Verifiability	Core focus: requires objective, reviewable evidence that requirements and expected behavior have been verified.
Traceability	Strongly emphasized through links between test basis, test design, execution records, and test reports.
Reproducibility	Standardized processes and documentation improve repeatability and reproducibility of test results across teams and time.
Auditability	Test evidence and reporting artifacts support internal/external assessments and compliance audits.
Correctness	Testing against expected outcomes helps detect deviations and defects in functional and non-functional behavior.
Reliability	Systematic dynamic testing contributes to confidence in stable behavior under intended operating conditions.
Maintainability	Structured regression testing assets and clearer test documentation support safer change and evolution.
Compliance	Consistent test records and reports provide evidence needed in contractual and regulated delivery contexts.

Concept	Description
Architecture Description (AD)	A collection of artifacts that document an architecture.
Entity of Interest (EoI)	The system, software, enterprise, or other entity whose architecture is being described.
Stakeholders	Individuals, teams, or organizations with an interest in the Entity of Interest.
Concerns	The interests that stakeholders have in the Entity of Interest, such as performance, security, or maintainability.
Viewpoint	A specification for constructing a single view. It defines the stakeholders, concerns, and modeling techniques to be used.
View	A representation of the architecture from the perspective of a particular viewpoint.
Architecture Decision	A key choice made during the design of the architecture. The standard requires that decisions and their rationale be documented.
Architecture Rationale	The justification for architectural decisions, linking them to stakeholder concerns and other requirements.

Component	Description
Architecture Evaluation Process	Systematic methodology for conducting architecture evaluations with defined phases, activities, and deliverables.
Evaluation Objectives	Clear specification of what the evaluation aims to achieve, including quality attributes, architectural decisions, and stakeholder concerns.
Evaluation Methods	Systematic approaches for conducting evaluations, including scenario-based methods, metrics-based analysis, and stakeholder reviews.
Architecture Quality Models	Frameworks for assessing architecture quality attributes such as performance, security, maintainability, and reliability.
Evaluation Criteria	Explicit criteria for judging architecture quality, including thresholds, targets, and acceptance criteria.
Stakeholder Involvement	Systematic engagement of stakeholders throughout the evaluation process to ensure relevance and buy-in.

Quality Attribute	Relevance in ISO/IEC/IEEE 42030
Evaluability	Core focus on making architectures systematically assessable through defined evaluation processes and criteria. This quality overlaps with Testability, Observability and Analysability
Traceability	Ensuring clear links between architectural decisions, quality requirements, and evaluation results.
Transparency	Making evaluation processes, criteria, and results visible and understandable to stakeholders.
Accountability	Providing systematic evidence and rationale for architecture quality assessments and decisions.
Maintainability	Evaluating how well the architecture supports ongoing modification and evolution.
Performance	Systematic assessment of architecture’s ability to meet performance requirements and constraints.
Security	Evaluation of architecture’s security properties, vulnerabilities, and risk mitigation approaches.
Reliability	Assessment of architecture’s dependability, fault tolerance, and failure recovery capabilities.
Scalability	Evaluation of architecture’s ability to handle growth in load, data, or functional requirements.
Interoperability	Assessment of architecture’s integration capabilities and compliance with interface standards.

Attribute	Relevance in MISRA C
Safety	The primary goal. The rules are designed to prevent undefined behavior and common programming errors that can lead to safety hazards.
Reliability	Enforced by rules that reduce the likelihood of defects and unexpected behavior.
Analyzability	A key goal. The guidelines are designed to make the code more analyzable by static analysis tools.
Maintainability	Promoted through rules that improve code clarity, consistency, traceability, and comprehensibility.
Flexibility	Addresses portability aspects by avoiding implementation‑defined behavior and reducing compiler-/platform‑specific constructs.
Security	Many rules that enhance safety also contribute to security by preventing vulnerabilities such as buffer overflows and data corruption.
Testability	Indirectly supported by rules that lead to simpler, more modular, and deterministic code, which is easier to test.
Efficiency	Indirectly supported by catching errors early in the development cycle, which leads to a more efficient development process.
Understandability	Promoted through rules that improve code clarity, consistency, and comprehensibility.

Characteristic	Description
Valid and Reliable	AI systems consistently deliver accurate, dependable results aligned with their intended purpose; performance generalizes appropriately across operating contexts
Safe	AI systems avoid imposing unacceptable risks to health, safety, or property of users and the broader public
Secure and Resilient	AI systems are robust against cybersecurity threats, adversarial inputs, and unexpected operating conditions while maintaining operational integrity
Accountable and Transparent	Organizations are open about AI use; decisions and outcomes are traceable; stakeholders can understand and contest results
Explainable and Interpretable	The reasoning behind AI outputs is knowable and communicable in terms meaningful to the intended audience
Privacy Enhanced	AI systems protect individual autonomy, identity, dignity, and sensitive personal information throughout the data lifecycle
Fair with Harmful Bias Managed	AI systems are free from unjustified bias and discrimination; harmful biases in data, models, and processes are identified and mitigated

Function	Purpose	Key focus areas
GOVERN	Establish organizational culture, policies, and accountability for AI risk management	Culture; accountability; workforce; third-party risk
MAP	Identify and contextualize AI systems, intended use, stakeholders, and associated risks	Context; categorization; impacts; third-party components
MEASURE	Select methods, metrics, and testing to evaluate AI risks quantitatively and qualitatively	Measurement methods; testing; actor competency; monitoring
MANAGE	Prioritize, respond to, and recover from identified AI risks	Risk response; benefit–risk balance; ongoing monitoring; TEVV

Category	Focus
GOVERN 1	Policies, processes, procedures, and practices for AI risk management are in place, documented, and organizationally embedded
GOVERN 2	Accountability structures are established; teams are trained and empowered to perform AI risk management responsibilities
GOVERN 3	Workforce diversity, equity, inclusion, and accessibility are prioritized throughout the AI lifecycle
GOVERN 4	Organizational culture actively considers and communicates AI risks and benefits
GOVERN 5	Relevant AI actors and stakeholders are engaged in AI risk management processes
GOVERN 6	Risks from third-party entities — including software, data, and AI supply chains — are addressed by organizational policies

Category	Focus
MAP 1	Context is established: intended purpose, beneficial uses, applicable laws, user expectations, and potential negative impacts
MAP 2	AI system categorization based on capabilities, intended use, and potential risk level
MAP 3	AI capabilities, targeted usage, goals, and expected benefits and costs are characterized against relevant benchmarks
MAP 4	Risks and benefits are mapped across all AI system components, including third-party software and training data
MAP 5	Impacts to individuals, groups, communities, organizations, and society are characterized and documented

Category	Focus
MEASURE 1	Measurement approaches (methods and metrics) are selected to evaluate identified risks and trustworthiness characteristics
MEASURE 2	Testing, evaluation, verification, and validation (TEVV) procedures detect, track, and measure known risks and negative impacts
MEASURE 3	AI actor competency — including awareness of trustworthiness characteristics — is regularly evaluated and documented
MEASURE 4	External inputs (training data, third-party models, APIs) are monitored for impact on system performance and risk posture

Category	Focus
MANAGE 1	Risks are prioritized against the AI system’s intended purpose, objectives, and organizational risk tolerance
MANAGE 2	Negative risks are weighed against benefits; trustworthiness trade-offs are documented and accepted by accountable stakeholders
MANAGE 3	Continuous monitoring and documentation of system performance relative to trustworthiness characteristics throughout the deployment lifecycle
MANAGE 4	Outputs from TEVV activities are incorporated into organizational risk management decisions, change management, and decommissioning

Standard	Relationship
ISO/IEC 42001	ISO 42001 provides a certifiable AI Management System (AIMS); the NIST AI RMF provides the risk management process. The two are complementary: NIST publishes an official crosswalk mapping AI RMF categories to ISO 42001 clauses. Organizations pursuing ISO 42001 certification frequently use the AI RMF as their underlying risk assessment methodology.
ISO/IEC 24028	ISO 24028 addresses trustworthiness in AI systems and enumerates overlapping trustworthiness characteristics. The frameworks use compatible terminologies; AI RMF cites ISO 24028 in its bibliography.
NIST SP 800-53	NIST publishes an official crosswalk between the AI RMF and SP 800-53 security and privacy controls, allowing organizations to align AI-specific risk management with their existing cybersecurity control frameworks.
ISO/IEC 22989	Provides the AI concepts and terminology referenced throughout the AI RMF, including definitions of AI system, AI lifecycle, and trustworthiness.

Quality Attribute	Relevance in NIST AI RMF
Safety	The Safe trustworthiness characteristic (MEASURE 2, MANAGE 1) requires that AI systems avoid unacceptable risks to health, safety, and property; TEVV processes must include safety-focused testing.
Security	The Secure and Resilient characteristic (GOVERN 6, MAP 4, MEASURE 2) requires assessment of adversarial robustness, supply chain risk, and cybersecurity controls across the AI lifecycle.
Resilience	Resilience is explicitly embedded in the Secure and Resilient characteristic; MANAGE 3 requires monitoring that systems maintain operational integrity under unexpected conditions.
Reliability	The Valid and Reliable characteristic (MEASURE 1, MEASURE 2) requires that AI systems deliver consistent, accurate results; performance metrics and benchmarking are mandated throughout MAP and MEASURE.
Accountability	The Accountable and Transparent characteristic and GOVERN 1–2 require documented accountability structures, traceable decisions, and clear assignment of responsibility across the AI lifecycle.
Transparency	Transparency is co-defined with accountability in the framework; GOVERN 4–5 require open communication of AI risks and stakeholder engagement in risk management processes.
Explainability	The Explainable and Interpretable characteristic requires that AI reasoning be communicable to its intended audience; MEASURE 2 includes evaluation of explainability as part of TEVV.
Privacy	The Privacy-Enhanced characteristic (MAP 5, MEASURE 2) requires data minimization, purpose limitation, and protection of personal information throughout the AI lifecycle, including in training data and model outputs.
Fairness	The Fair with Harmful Bias Managed characteristic (MAP 5, MEASURE 2, MANAGE 2) requires identification, measurement, and mitigation of harmful biases in data, models, and deployment contexts.

Function	Purpose
IDENTIFY-P	Develop an organizational understanding of privacy risk to systems, people, assets, and data. Includes data inventory and mapping, understanding data processing roles, and privacy risk assessment.
GOVERN-P	Develop and implement organizational governance structures for privacy. Covers privacy policies, roles and accountability, legal basis for data processing, and privacy risk management strategy.
CONTROL-P	Develop and implement activities that allow individuals and organizations to manage data with sufficient granularity to manage privacy risks. Includes data minimization, purpose limitation, consent mechanisms, and individual rights support.
COMMUNICATE-P	Develop and implement activities that enable organizations and individuals to have a reliable understanding of how data are processed and associated risks. Covers privacy notices, transparency reporting, and stakeholder engagement.
PROTECT-P	Develop and implement appropriate safeguards for data processing to prevent privacy risks from materializing. Includes data security controls, access management, and data lifecycle management.

Quality Attribute	Relevance in NIST Privacy Framework
Privacy	The central focus of the framework: structured risk management for the entire personal data lifecycle, from collection through deletion.
Confidentiality	PROTECT-P requires safeguards to prevent unauthorized access or disclosure of personal information throughout processing.
Compliance	GOVERN-P addresses legal bases for processing and alignment with applicable privacy regulations; crosswalks map the PF directly to GDPR and ISO 29100.
Transparency	COMMUNICATE-P requires organizations to disclose data practices reliably and enable informed engagement from individuals.
Accountability	GOVERN-P establishes clear ownership of privacy responsibilities; accountability for processing decisions is a core governance requirement.
Traceability	IDENTIFY-P requires data inventory and mapping — understanding what data is collected, where it flows, who processes it, and for what purpose.
Security	PROTECT-P overlaps with cybersecurity controls; NIST publishes an official crosswalk to SP 800-53 security and privacy controls.
Fairness	CONTROL-P addresses data minimization and purpose limitation — ensuring individuals’ data is not used in ways they would not reasonably expect.

Standard	Relationship
GDPR	GDPR is a binding regulation; the Privacy Framework is a voluntary risk management tool. NIST publishes an official crosswalk mapping PF categories to GDPR articles. Organizations use the PF to operationalize GDPR compliance systematically rather than treating it as a pure checklist.
ISO/IEC 29100	ISO 29100 provides privacy principles and a terminology framework; the NIST PF provides the operational risk management structure. The two are complementary — ISO 29100 defines what privacy means, the PF defines how to manage it as an organizational risk.
NIST SP 800-53	NIST publishes an official crosswalk between the Privacy Framework and the SP 800-53 privacy controls (the `PT` control family and others). Organizations already using SP 800-53 can extend it with PF profiles to address privacy risk beyond compliance controls.
ISO/IEC 27001	ISO 27001 focuses on information security management; PROTECT-P draws on the same safeguarding principles. The PF is broader: it addresses privacy risks arising from legitimate data processing, not just security incidents.

Level	Share of Requirements	Intent
L1 — Basic	~20%	Critical first-layer defences against the most commonly exploited vulnerabilities; appropriate as a minimum baseline for any web application
L2 — Standard	~50%	Protections against less common or more complex attack patterns; recommended for most business applications handling sensitive data
L3 — Advanced	~30%	Defence-in-depth controls for the highest-assurance contexts (financial, healthcare, critical infrastructure)

AIUC-1: (attempt of an) AI agent standard

Core Principles

Relationship to Quality Attributes

References

C3A: Cloud Autonomy

Scope and Coverage

Relationship to Other Standards

Quality Attributes Addressed

References

Official Sources

Cyber Resilience Act (CRA)

Scope:

Core obligations for manufacturers

What does CRA mean for software and systems engineering?

Related quality attributes impacted by CRA

References (authoritative sources)

Supportive technical guidance (Germany)

DICOM: Medical Imaging Interoperability

Scope and Purpose

Core DICOM Components (selection)

Quality Attributes Addressed or Influenced

Authoritative Sources

Key ideas

DO-178C document family

Typical structure and compliance artifacts

Quality Attributes Required or Emphasized

References

EN 301 549: Accessibility requirements for ICT products and services

Evolution and Future Development

Scope and Coverage

Self-Scoping Concept

Structure and Organization

Key Clauses

Important Annexes

Relationship to WCAG

WCAG2ICT Application

WCAG POUR Principles in EN 301 549

Future WCAG 2.2 Alignment

Quality Attributes Required or Emphasized

References and Resources

Official ETSI/CEN/CENELEC Sources

EU Legislation

WCAG and Related Standards

ETSI EN 304 223: Securing Artificial Intelligence (SAI) - Baseline Cyber Security Requirements for AI Models and Systems

Quality Attributes Required or Emphasized

Five Lifecycle Phases

1. Secure Design (Principles 1-4)

2. Secure Development (Principles 5-9)

3. Secure Deployment (Principle 10)

4. Secure Maintenance (Principles 11-12)

5. Secure End-of-Life (Principle 13)

AI-Specific Threats Addressed

Related Standards and Regulations

References

EU CSF: Assessing Cloud Sovereignty

Assessment

Quality Attributes Addressed

References

Official Sources

GDPR: General Data Protection Regulation (EU) 2016/679

Quality Attributes Required or Emphasized

Key Principles and Technical Requirements

Data Protection by Design and by Default (Article 25)

Individual Rights Implementation

Legal Bases and Processing Limitations

Security and Breach Management

Compliance Requirements for Software Systems

Data Protection Impact Assessment (DPIA)

Records of Processing Activities

Cross-Border Data Transfers

References

HL7: Healthcare Interoperability Standards

Scope and Purpose

Core HL7 Standards (selection)

FHIR in Focus (selection)

Quality Attributes Addressed or Influenced

Authoritative Sources

IEC 61508: Functional safety (generic, cross-industry)

Scope and core concepts (at a glance)

Qualities addressed by IEC 61508

Chapter	Topic
V1	Encoding and Sanitization
V2	Validation and Business Logic
V3	Web Frontend Security
V4	API and Web Service
V5	File Handling
V6	Authentication
V7	Session Management
V8	Authorization
V9	Self-contained Tokens
V10	OAuth and OIDC
V11	Cryptography
V12	Secure Communication
V13	Configuration
V14	Data Protection
V15	Secure Coding and Architecture
V16	Security Logging and Error Handling
V17	WebRTC

Quality Attribute	Relevance in OWASP ASVS
Security	Core focus of the entire standard; all 17 chapters collectively define what it means for a web application to be secure.
Access Control	V8 (Authorization) specifies requirements for enforcing least-privilege, preventing privilege escalation, and protecting resource boundaries.
Authenticity	V6 (Authentication), V9 (Self-contained Tokens), and V10 (OAuth and OIDC) define how systems must verify the identity of users and services.
Confidentiality	V12 (Secure Communication) and V14 (Data Protection) require encryption in transit, secure storage, and minimisation of sensitive data exposure.
Data Integrity	V1 (Encoding and Sanitization) and V11 (Cryptography) mandate that data is protected from tampering through input validation and cryptographic integrity controls.
Non-Repudiation	V16 (Security Logging and Error Handling) requires tamper-evident, attributable audit logs that make actions traceable to authenticated identities.
Intrusion Prevention	V1 (Encoding and Sanitization) and V2 (Validation and Business Logic) address injection, XSS, and business-logic attacks — the primary application-layer intrusion vectors.
Intrusion Detection	V16 requires logging of security-relevant events at sufficient fidelity to detect and investigate attacks after the fact.
Auditability	V16 specifies what must be logged, the required log content, and protection of log integrity to support forensic investigations and compliance audits.
Vulnerability	The ASVS level model directly operationalises vulnerability risk: L1 addresses high-severity, easily exploitable weaknesses; L3 addresses sophisticated, low-probability threats.
Resistance	V2 (Validation and Business Logic), V3 (Web Frontend Security), and V4 (API and Web Service) define how applications must resist abuse, denial-of-service, and data exfiltration patterns.

Control Objective	Requirements	Purpose
Build and maintain secure networks	1-2	Install network security controls and secure system configurations
Protect cardholder data	3-4	Protect stored account data and encrypt transmission over public networks
Maintain vulnerability management	5-6	Protect against malware and develop secure systems
Implement access controls	7-8	Restrict access by business need and authenticate users
Monitor and test networks	9-11	Restrict physical access, log activity, and test security regularly
Maintain information security policy	12	Support information security with organizational policies

Attribute	Relevance in PCI-DSS
Security	Core objective: prevent unauthorized disclosure, alteration, and misuse of payment account data across people, process, and technology
Confidentiality	Encryption and key management protect stored data; strong cryptography protects data in transit
Integrity	Secure configurations, change controls, code security, and monitoring reduce risk of unauthorized or accidental modification
Availability	Indirectly supported via hardening, malware protection, logging/monitoring, and testing that reduce outages due to security incidents
Access Control	Need-to-know access, least privilege, strong authentication (including MFA), and session management
Authenticity	User identification and robust authentication to ensure actions are attributable to legitimate identities
Accountability	Detailed logging, monitoring, and review of security events and access to cardholder data
Compliance	Demonstrable conformance through assessments (QSA, SAQ) and brand/acquirer validation programs
Non-repudiation	Detailed audit trails to prevent denial of payment transactions and security events
Vulnerability Management	Regular vulnerability scanning and security testing requirements

Type	Scope	Typical use
Type I	Controls are designed appropriately at a specific point in time	Initial market entry; demonstrates readiness
Type II	Controls operated effectively over an examination period — minimum 3 months, typically 6–12 months	Ongoing customer assurance; most procurement requirements

Category	Required?	What it covers
Security	Always required	Protection of system assets against unauthorized access (logical and physical)
Availability	Optional	System is available for operation and use as committed
Processing Integrity	Optional	System processing is complete, valid, accurate, timely, and authorized
Confidentiality	Optional	Information designated as confidential is protected as committed
Privacy	Optional	Personal information is collected, used, retained, disclosed, and disposed of in conformity with commitments

Criteria group	Focus area
CC1	Control Environment — commitment to integrity, competence, accountability
CC2	Communication and Information — internal and external communication of control responsibilities
CC3	Risk Assessment — identification and analysis of risks to achieving objectives
CC4	Monitoring Activities — ongoing evaluation of controls
CC5	Control Activities — policies and procedures to mitigate identified risks
CC6	Logical and Physical Access Controls — authentication, authorization, encryption, physical security
CC7	System Operations — detection and response to threats; incident management
CC8	Change Management — authorization, testing, and approval of system changes
CC9	Risk Mitigation — vendor management; business continuity

Standard	Relationship
ISO/IEC 27001	ISO 27001 provides formal certification of an Information Security Management System; SOC 2 provides an independent attestation report. The two share approximately 96% of control objectives and are frequently pursued together. ISO 27001 is preferred for international markets; SOC 2 for US-dominated B2B contexts.
SOX	SOC 2 emerged from the same assurance ecosystem as SOX (Sarbanes-Oxley); a SOC 1 report covers financial reporting controls relevant to SOX, while SOC 2 covers operational and security controls that are complementary.
PCI DSS	PCI DSS governs payment card data; many organizations pursue both. A SOC 2 report with Processing Integrity and Confidentiality in scope provides significant overlap with PCI DSS requirements.
NIST SP 800-53	The AICPA publishes an official crosswalk between the Trust Services Criteria and NIST SP 800-53 controls, allowing organizations to map SOC 2 evidence directly to NIST requirements.

Section	Requirement	Software System Implications
Section 302	CEO/CFO Certification of Financial Reports	Systems must provide accurate, complete financial data with documented controls and audit trails for executive certification.
Section 404	Internal Controls Over Financial Reporting (ICFR)	Mandatory documentation and testing of IT controls that impact financial reporting accuracy and completeness.
Section 409	Real-time Disclosure of Material Changes	Systems must support timely capture and reporting of material events affecting financial position.
Section 802	Document Retention and Destruction	Electronic document management systems must implement proper retention policies and prevent improper destruction.
Section 906	Criminal Penalties for False Certification	Systems must provide reliable data integrity to prevent inadvertent false certifications by executives.

Quality Attribute	Relevance in SOX Compliance
Data Integrity	Core requirement for accurate financial data throughout processing, storage, and reporting lifecycle with protection against unauthorized modification.
Auditability	Comprehensive audit trails for all financial data changes, user actions, and system activities to support internal and external audits.
Accountability	Clear assignment of responsibility for financial data accuracy with documented roles, approvals, and sign-offs in system workflows.
Traceability	Complete lineage tracking of financial data from source transactions through consolidation, adjustments, and final reporting.
Access Control	Segregation of duties through role-based access controls preventing single individuals from initiating and approving financial transactions.
Compliance	Adherence to SOX requirements, GAAP accounting principles, and SEC reporting standards embedded in system design and controls.
Security	Protection of financial data against unauthorized access, modification, or disclosure with appropriate encryption and access logging.
Reliability	Consistent, dependable operation of financial systems to ensure accurate and timely financial reporting without data loss or corruption.
Documentation	Comprehensive documentation of system controls, processes, and procedures to support SOX compliance testing and audits.
Change Management	Controlled modification processes for financial systems with proper testing, approval, and documentation of changes.